That Little Dot and Three Letters Are Lying to You — Here's How to Catch Them

You get an email. The attachment says invoice_april.pdf. Looks fine, right? You've opened a hundred PDFs just like it. You double-click it, and instead of Adobe Reader popping up, something weird happens. Your screen flickers. A program runs. And just like that, your computer has a problem.

The file was never a PDF. It was an executable dressed up like one. And your operating system helped pull off the trick.

This isn't some exotic hacker technique reserved for spy movies. It's one of the oldest and most effective scams in the book — and it works because most people have a pretty reasonable but dangerously incomplete understanding of how file extensions actually work.

What a File Extension Actually Does (And Doesn't Do)

Let's back up. A file extension is just a suffix tacked onto the end of a filename — the .docx in resume.docx, the .jpg in vacation_photo.jpg. Your operating system uses that suffix to decide which program should open the file. That's basically it.

Here's the critical part: the extension doesn't define what's inside the file. It's more like a label on a box than a description of the contents. You can slap any label on any box. The box doesn't care.

Windows, macOS, and Linux all read the extension and make assumptions. Windows in particular is famous for hiding extensions from users by default — meaning malware.exe can show up in your file explorer as just malware, which tells you absolutely nothing about what it is.

That default setting alone has contributed to countless malware infections over the decades.

The Classic Tricks Scammers Use

The Double Extension Trick

This one is almost embarrassingly simple. A scammer names a file document.pdf.exe. On a system where extensions are hidden, this displays as document.pdf. The icon might even be swapped out to look like an Acrobat file. You see a PDF. You open an executable.

The Unicode Reversal Attack

This one is genuinely sneaky. Unicode — the international character encoding standard — includes a special character called the Right-to-Left Override (RLO). Inserting this invisible character into a filename can reverse the display order of the text that follows it.

So a file actually named malware_fdp.exe can be made to display as malware_exe.pdf. The real extension is still .exe. The file is still a program. But your eyes read it backward and see .pdf.

The Lookalike Icon Swap

Windows and macOS let developers assign any icon to any executable. A malicious .exe can wear the exact icon Adobe Reader uses for PDFs, or the icon Microsoft Word uses for .docx files. Combined with a hidden extension, the file looks completely legitimate at a glance.

Compressed File Camouflage

Scammers also love .zip and .rar archives because people associate them with harmless collections of files. Unzip the archive, though, and the contents might include executables with spoofed extensions waiting for you to click.

Real-World Scenarios Where This Actually Bites People

Think about your own life for a second. How many times have you:

• Downloaded something from a file-sharing site or a random Google result?
• Opened an attachment from someone you sort of know but weren't 100% expecting to hear from?
• Unzipped a file someone sent you over Discord, Slack, or a forum?

Each of those moments is an opportunity for a spoofed extension to do its thing. The IRS scam emails that spike every tax season frequently use this technique — fake "tax document" attachments that are actually info-stealing malware. So do fake shipping notification emails from "FedEx" or "UPS" that flood inboxes around the holidays.

Small business owners are a particularly common target. An email that looks like a vendor invoice, complete with a convincing PDF icon? Most people just open it.

How to Actually Verify What a File Is

Okay, enough doom and gloom. Here's the practical stuff.

Step 1: Make extensions visible.

On Windows 11 or 10, open File Explorer, click the View menu, then Show, and make sure "File name extensions" is checked. Now you'll see the real extension on every file, every time. Do this right now if you haven't already. Seriously.

On macOS, go to Finder > Settings (or Preferences on older versions) > Advanced, and check "Show all filename extensions."

Step 2: Check the file type, not just the name.

Right-click any suspicious file and look at its properties. On Windows, the Properties window will show you the file type. A file claiming to be a PDF should say "Adobe Acrobat Document" or similar — not "Application."

Step 3: Use a tool that reads the file header.

Every file format has a signature — a specific sequence of bytes at the very start of the file that identifies what it actually is, regardless of its extension. Tools like file (built into macOS and Linux terminals) read this signature directly.

On Windows, free tools like TrID or HxD (a hex editor) let you peek at a file's true identity. This is what security researchers do. It takes thirty seconds.

Step 4: When in doubt, scan before you open.

Virustotal.com lets you upload any file and scan it against dozens of antivirus engines simultaneously. It's free, takes about a minute, and has saved a lot of people from a very bad afternoon.

Step 5: Never open executable files from untrusted sources.

This sounds obvious, but it's worth saying plainly. .exe, .msi, .bat, .cmd, .vbs, .ps1, .jar — these are all file types that can run code on your computer. If you weren't expecting one, don't open it. If you were expecting one, still verify it.

The Bigger Picture

File extensions were designed for convenience, not security. They were a shorthand that made sense when personal computing was young and the threat landscape was basically nothing. Today they're a liability that the entire industry has patched around but never really fixed.

Operating systems have gotten better — Windows now shows warnings when you try to run certain downloaded executables, and macOS's Gatekeeper blocks unsigned apps by default. But those protections are bypassable, and social engineering (a fancy term for "tricking people") can convince users to click through warnings anyway.

The most reliable protection is still a well-informed user. Now that you know the extension is just a label, you can stop trusting it blindly — and start actually checking what's inside the box.